I am pretty sure my job would be on the line if I neglected to report a security issue. It is Google's incentives which are not aligned.